denoland/deno · error · TypeError

ERR_INVALID_ARG_VALUE

ERR_INVALID_ARG_VALUE

Error message

The property 'options.dsaEncoding' is invalid. Received ${dsaEncoding}

What it means

Thrown by getDSASignatureEncoding in Deno's node:crypto polyfill (ext/node/polyfills/internal/crypto/sig.ts:90) when the dsaEncoding option on the key object passed to sign()/verify() is not 'der' or 'ieee-p1363'. EC/DSA signatures can be encoded either as DER (default) or as the fixed-length IEEE P1363 r||s form; any other string is rejected with ERR_INVALID_ARG_VALUE.

Source

Thrown at ext/node/polyfills/internal/crypto/sig.ts:90

const FastBuffer = Buffer[SymbolSpecies];

function getPadding(options) {
  return getIntOption("padding", options);
}

function getSaltLength(options) {
  return getIntOption("saltLength", options);
}

function getDSASignatureEncoding(options) {
  if (typeof options === "object") {
    const { dsaEncoding = "der" } = options;
    if (dsaEncoding === "der") {
      return 0;
    } else if (dsaEncoding === "ieee-p1363") {
      return 1;
    }
    throw new ERR_INVALID_ARG_VALUE("options.dsaEncoding", dsaEncoding);
  }

  return 0;
}

function getIntOption(name, options) {
  const value = options[name];
  if (value !== undefined) {
    if (value === value >> 0) {
      return value;
    }
    throw new ERR_INVALID_ARG_VALUE(`options.${name}`, value);
  }
  return undefined;
}

// Private key types that need to be converted to public keys for verification
const PRIVATE_KEY_TYPES = ["pkcs8", "sec1"];

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Use exactly 'ieee-p1363' or 'der' (the default — omit dsaEncoding for DER).
2. If you need WebCrypto-style raw signatures, keep the byte-exact string 'ieee-p1363' in a shared constant.
3. Check both the signing and verifying sides use the same encoding string.

Example fix

// before
const sig = crypto.sign('sha256', data, { key, dsaEncoding: 'p1363' });

// after
const sig = crypto.sign('sha256', data, { key, dsaEncoding: 'ieee-p1363' });

const DSA_ENCODINGS = new Set(['der', 'ieee-p1363']);
if (keyObj.dsaEncoding !== undefined && !DSA_ENCODINGS.has(keyObj.dsaEncoding)) throw new TypeError('dsaEncoding must be der or ieee-p1363');

const isDsaEncoding = (v) => v === undefined || v === 'der' || v === 'ieee-p1363';

try { sig = crypto.sign(algo, data, keyObj); } catch (e) { if (e.code === 'ERR_INVALID_ARG_VALUE' && e.message.includes('dsaEncoding')) { keyObj = { ...keyObj, dsaEncoding: 'ieee-p1363' }; sig = crypto.sign(algo, data, keyObj); } else throw e; }

When it happens

Trigger: crypto.sign(null, data, { key: ecPrivateKey, dsaEncoding: 'p1363' }) — the correct spelling is 'ieee-p1363'. Also 'ieeeP1363', 'P1363', or passing dsaEncoding on a non-DSA flow with a stray value.

Common situations: Interop with JWS/COSE/WebCrypto which use the raw r||s format, where developers abbreviate the option name; casing errors; copying the option between sign and verify with different spellings so one side fails.

Related errors

• ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE
• Invalid digest: ${algorithm}
• ERR_CRYPTO_SIGN_KEY_REQUIRED
• ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED
• ERR_INVALID_ARG_TYPE

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/81d18be7351d448d. Report an issue: GitHub.